Faber v. Ciox Health, LLC

331 F. Supp. 3d 767

• Court: District Court, W.D. Tennessee
• Decided: July 24, 2018
• Docket: No. 2:16-cv-02337-STA-cgc
• Status: Published

Opinion

S. THOMAS ANDERSON, CHIEF UNITED STATES DISTRICT JUDGE

Before the Court are Defendant's Motion for Summary Judgment (ECF No. 87) and Plaintiffs' Motion for Partial Summary Judgment (ECF No. 95). Defendant Ciox Health, LLC, d/b/a Healthport Technologies, LLC, seeks dismissal of Plaintiffs' class-action and individual claims stemming from allegations of routine and systematic overcharging for access to medical records. Plaintiffs Richard Faber and Jennifer Monroe, on behalf of themselves and similarly situated persons, seek summary judgment on the issue of Defendant's liability in each of their claims. The overarching issue in this case is whether Defendant's actions are remediable under Tennessee law. Plaintiffs have advanced a number of theories to this effect, most prominently that, if Defendant's actions violated the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") or the Health Information Technology for Economic and Clinical Health Act ("HITECH"), then Defendant can be held liable under a theory of negligence per se. Plaintiffs also make a number of arguments that Defendant's actions independently gave rise to several Tennessee common law claims. And Plaintiffs further assert that Defendant's actions violated the State's consumer protection statute. The Court ultimately holds, however, that there is no independent cause of action under Tennessee law, even under a theory of negligence per se , for a violation of HIPAA or HITECH. The Court further holds that the evidence supporting Plaintiffs' claims of overcharging does not translate into any of the Tennessee common law claims pursued by Plaintiffs. And finally, the Court holds that Plaintiffs have *772not established a violation of Tennessee's consumer protection statute. Accordingly, Defendant's Motion for Summary Judgment is hereby GRANTED , and Plaintiffs' Motion for Partial Summary Judgment is hereby DENIED . This action is therefore DISMISSED . The Clerk is DIRECTED to enter Judgment forthwith in favor of Defendant.

BACKGROUND

The following facts are undisputed by the parties unless otherwise noted.

I. Defendant Ciox Health, LLC, d/b/a Healthport Technologies, LLC

Defendant is the largest clinical data exchange platform in the United States. Defendant was created by the merger of four medical records providers-HealthPort, IOD, Care Communication, and ECS-that were acquired by Defendant's parent company, New Mountain Capital, in 2016. Defendant subsequently acquired a fifth medical record provider, ArroHealth, increasing its size even further. Today, Defendant is perhaps¹ the largest medical records provider in the country and boasts of processing 4.3 million pages of medical records per day. Three out of every five hospitals in the United States utilize Defendant for medical records release services. Defendant holds itself out as a HIPAA-compliant provider of medical records on behalf of its medical provider clients. Defendant also holds itself out as a provider that fulfills requests for medical records in a timely manner. As a routine practice, Defendant charges attorneys requesting medical records on behalf of their clients at a rate that exceeds the standard cost-based rate.² Defendant does not attempt to track its actual costs incurred in responding to each medical records request it receives.

Defendant entered into a contract with Vanderbilt University Medical Center ("Vanderbilt") to provide Vanderbilt with medical records request fulfillment services, also known as "release of patient health information" or "ROI" services. Pursuant to its contract with Vanderbilt, Defendant is required to open mail, verify authorizations, log requests, transmit records, and answer phone calls regarding medical records requests on behalf of Vanderbilt. Defendant likewise receives, opens, and reviews all incoming requests for health information sent to Vanderbilt and processes all written requests, walk-in requests, and telephone requests for copies of patient health information. Further, Defendant maintains a 72-hour turnaround time for all routine requests, provided the records are complete and in their proper place.

Defendant also entered into a contract with the Shelby County Health Care Corporation d/b/a Regional One Health ("the Med") to provide the Med with medical records request fulfillment services. The Med, under its contract with Defendant, has outsourced its medical records request fulfillment needs to Defendant. Pursuant to that contract, Defendant provides employees on site at the Med, as well as all necessary technology, equipment, and supplies to review requests for health information *773and fulfill those requests. Defendant is also required to open correspondence requesting medical records, verify all requests to ensure compliance with state and federal law, retrieve the requested information, transmit records, provide personnel for walk-in requests, and answer telephone inquiries.

II. Plaintiff Richard Faber

Plaintiff Richard Faber was represented by the law firm of Ballin, Ballin & Fishman, PC., in litigation in connection with an automobile accident. Plaintiff Faber, pursuant to his contract with Ballin, Ballin & Fishman, P.C., understood and agreed to pay all litigation expenses incurred from his share of the settlement or judgment. Plaintiff Faber's case resulted in a favorable jury verdict, from which he was contractually obligated to reimburse Ballin, Ballin & Fishman, P.C., for its litigation expenses. On January 16, 2015, Diane Asbridge, a paralegal with the law firm Ballin, Ballin & Fishman, P.C., sent a letter to the Med on behalf of Plaintiff Faber. At that time, Ms. Asbridge was acting pursuant to her authority as an employee of Ballin, Ballin & Fishman, P.C. Ms. Asbridge's January 16, 2015 letter stated, in part, "[p]lease provide this office with a complete copy of any and all records on Richard D. Faber...." Ms. Asbridge's January 16, 2015 letter also enclosed a form titled "HIPAA Compliant Authorization for Release of Medical Information." This form was signed by Melissa Faber. Mrs. Faber is Plaintiff Faber's wife and personal representative. On February 28, 2015, Defendant electronically provided the records requested by Ms. Asbridge through HealthPortConnect, Defendant's online portal. That same day, Defendant sent an invoice to Ms. Asbridge for a total of $235.30.³ That invoice listed the following charges:

a "Basic Fee" of $18.00; a "Per Page Copy (Paper) 2" fee of $120 for a "Quantity" of 200 at a "Unit Price" of $0.60; a "Per Page Copy (Paper) 4" fee of $0.00 for a "Quantity" of 5 at a "Unit Price" of $0.00; a "Per Page Copy (Paper) 3" fee of $38.25 for a "Quantity" of 45 at a "Unit Price" of $0.85; a "Per Page Copy (Paper) 1" fee of $57.05 for a "Quantity" of 163 at a "Unit Price" of $0.35; and an "Electronic Delivery Fee" of $2.00.

Def.'s Statement of Undisputed Facts, ¶ 8, Apr. 26, 2018, ECF No. 89 (quoting HealthPort Invoice No. 0163671769, ECF No. 90-2). On December 8, 2015, Defendant provided additional medical records through HealthPortConnect at Ms. Asbridge's request. That same day, Defendant sent Ms. Asbridge an invoice for a total of $704.65.⁴ That invoice listed the following charges:

a "Basic Fee" of $18.00; a "Per Page Copy (Paper) 2" fee of $120 for a "Quantity" of 200 at a "Unit Price" of $0.60; a "Per Page Copy (Paper) 4" fee of $0.00 for a "Quantity" of 5 at a "Unit Price" of $0.00; a "Per Page Copy (Paper) 3" fee of $38.25 for a "Quantity" of 45 at a "Unit Price" of $0.85; a "Per Page Copy (Paper) 1" fee of $526.40 for a "Quantity" of 1504 at a "Unit Price" of $0.35; and an "Electronic Delivery Fee" of $2.00.

*774Def.'s Statement of Undisputed Facts, ¶ 11, ECF No. 89 (quoting HealthPort Invoice No. 0182201188, ECF No. 90-4). Plaintiff Faber testified that he did not recall ever having seen either of these invoices before his deposition and that they were never sent to him personally.⁵ Ballin, Ballin & Fishman, P.C., paid both invoices on Plaintiff Faber's behalf. Plaintiff Faber testified that he had no relationship or contract with Defendant. Plaintiff Faber testified that he was not asserting any claim for unreasonable delay in the provision of his medical records.

III. Plaintiff Jennifer Monroe

Plaintiff Jennifer Monroe, acting individually and on behalf of her minor child, authorized her attorneys to act on her behalf in requesting medical records. Plaintiff Monroe retained the law firm of Wolff Ardis, P.C., as her attorneys for her minor daughter's personal injury case. Plaintiff Monroe did not retain any individual attorney from Wolff Ardis, P.C., to act on her behalf. On January 20, 2016, Plaintiff Monroe, acting through said attorneys, requested that her daughter's medical records be provided to Wolff Ardis, P.C.⁶ On January 29, 2016, Andrea Harris, a paralegal at Wolff Ardis, P.C., re-sent or sent for the first time, see supra note 6, Plaintiff Monroe's request to the Center for Health Information Management in Tennessee. Ms. Harris, at the time she sent letters on Plaintiff Monroe's behalf, was acting pursuant to her authority as an employee of Wolff Ardis, P.C. At least one of these letters stated, in part, "our office represents Jennifer Monroe and her minor daughter ... please forward copies of all CT Scans, X-Rays, and MRIs in their native or DICOM format...." Ms. Harris's January 2016 letter or letters included a form titled "Center for Health Information Management Authorization for Release of Medical Information" signed by Plaintiff Monroe. A request letter from Plaintiff Monroe attached to the letter from Ms. Harris asked for the records to be provided "in electronic form on CD in the Adobe Acrobat .pdf format." On February 11, 2016, Defendant sent an invoice to Ms. Harris for a total of $40.51.⁷ That invoice listed the following charges:

a "Basic Fee" of $18.00; a "Per Page Copy (Paper) 1" fee of $17.00 for a "Quantity" of 20 at a "Unit Price" of $0.85; a "Per Page Copy (Paper) 2" fee of $0.00 for a "Quantity" of 5 at a "Unit *775Price" of $0.00; a "Shipping" fee of $2.08; and "Sales Tax" of $3.43.

Def.'s Statement of Undisputed Facts, ¶ 18, ECF No. 89 (quoting HealthPort Invoice No. 0186100957, ECF No. 90-7). Having not yet received the records, Plaintiff Monroe had her attorneys or their paralegals send the request once again by facsimile on February 16, 2016, and again on February 17, 2016. On February 25, 2016, Plaintiff Monroe's attorneys advised Vanderbilt that it was in violation of state and federal law by failing to provide the medical records requested. On March 2, 2016, Defendant sent Ms. Harris hard copies of certain medical records of Plaintiff Monroe's minor child.⁸ Also in March 2, 2016, Defendant sent an invoice to Ms. Harris for a total of $30.74.⁹ That invoice listed the following charges:

a "Basic Fee" of $18.00; a "Per Page Copy (Paper) 1" fee of $8.50 for a "Quantity" of 10 at a "Unit Price" of $0.85; a "Per Page Copy (Paper) 2" fee of $0.00 for a "Quantity" of 5 at a "Unit Price" of $0.00; a "Shipping" fee of $1.64; and a "Sales Tax" of $2.60.

Def.'s Statement of Undisputed Facts, ¶ 22, ECF No. 89 (quoting HealthPort Invoice No. 0187519649, ECF No. 90-9). Plaintiff Monroe testified that she did not recall ever having seen these invoices before her deposition. Plaintiff Monroe also testified that she was not aware of any attempts to collect on the invoices until her attorneys made her aware the week before her deposition. Neither Plaintiff Monroe, nor Ms. Harris, nor anyone else at Wolff Ardis, P.C., paid Defendant for these invoices. And on August 2, 2016, Ms. Harris once again sent a letter to the Center for Health Information Management. The letter stated, in part, "[p]lease forward a copy of any and all of [Plaintiff Monroe's minor daughter's] medical records...." Defendant, however, sent a letter on August 12, 2016, to Plaintiff Monroe's attorneys, stating it would not provide the requested records unless Plaintiff Monroe completed a HIPAA authorization in the form approved by Defendant. On August 16, 2016, Defendant sent Wolff Ardis, P.C., an invoice for a total of $21.34.¹⁰ That invoice listed the following charges:

a "Basic Fee" of $18.00; a "Per Page Copy (Paper) 1" fee of $0.85 for a "Quantity" of 1 at a "Unit Price" of $0.85; a "Per Page Copy (Paper) 2" fee of $0.00 for a "Quantity" of 5 at a "Unit Price" of $0.00; a "Shipping" fee of $0.68; and "Sales Tax" of $1.81.

Def.'s Statement of Undisputed Facts, ¶ 28, ECF No. 89 (quoting HealthPort Invoice No. 019860061, ECF No. 90-10). Wolff Ardis, P.C., paid Defendant the amount reflected in the invoice. Plaintiffs' Amended Complaint (ECF No. 15) does not reference that invoice because the invoice was generated after Plaintiffs filed the Amended Complaint. Defendant ultimately provided records from the January 29, 2016 request on November 9, 2016. Then, on January 30, 2017, Defendant received an additional letter requesting the medical records of Plaintiff Monroe's minor daughter. Attached to the letter was a form titled "HITECH and HIPAA Compliant Authorization for the Release of Patient Information Pursuant to 45 CFR 164.524(c)(4)(I) & 164.508." This form stated, in part, that "[t]his is request under the HITECH Act to provide any attorneys *776with my medical records in electronic format." It also stated that "[t]his protected health information is disclosed for the following purposes: At the request of the individual patient." It further stated that Defendant was "authorized to release my requested records to Wolff Ardis, P.C. My lawyers agree to pay reasonable charges made by [Defendant] to supply electronic copies of such records." The form was signed by Plaintiff Monroe. On February 7, 2017, Defendant sent an invoice to Erin K. Bradley at Wolff Ardis, P.C., for a total of $12.00. That invoice stated the following charges: "a 'Reproduction Fee Paper 0.07 per page' for $4.27; a 'Mailing Supplies' fee of $0.32; a 'Supplies' fee of $3.05 at a 'Unit Price' of $0.05 for a 'Quantity' of 61; a 'Shipping' fee of $3.29; and 'Sales Tax' of $1.07." Def.'s Statement of Undisputed Facts, ¶ 34, ECF No. 89 (quoting Ciox Health Invoice No. 0209791467, Feb. 7, 2017, ECF No. 90-11). Plaintiffs' Amended Complaint does not reference that invoice because the invoice was generated after Plaintiffs filed the Amended Complaint. Wolff Ardis, P.C., paid Defendant the amount reflected in that invoice. Defendant threatened Plaintiff Monroe's attorneys with collection actions and legal activities when she refused to pay the allegedly excessive rates for her medical records. Defendant refused to provide the records requested by Plaintiff Monroe, her attorneys, or their paralegals until the instant lawsuit was filed. Throughout this process, Plaintiff Monroe made medical decisions for her minor daughter; Plaintiff Monroe's attorneys did not. Plaintiff Monroe testified that her daughter's case settled out of court, but that Defendant's delay "could have hurt the case a lot more." Plaintiff Monroe does not recall speaking to any employee of Defendant regarding her minor daughter's medical records. Plaintiff Monroe testified that she did not know if she had a contract with Defendant.

IV. Plaintiffs as a Class

Plaintiffs were charged "per page (paper)" fees despite requesting and receiving medical records in an electronic format.¹¹ From May 13, 2010, to October 31, 2017, Defendant collected $19,449,024.49 from 427,143 medical records requests made by individuals or their attorneys in Tennessee. During that same timeframe, Defendant charged Class Members per-page (paper) fees when records were delivered electronically on 83,325 invoices, charging a total of $3,655,535.24. Defendant charged Plaintiffs, their attorneys, or their paralegals electronic delivery and basic fees that exceeded $6.50.

STANDARD OF LAW

Summary judgment is proper where the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law. Fed. R. Civ. P. 56. When deciding a motion for summary judgment, the Court must review all the evidence, viewing it in a light most favorable to the nonmoving party and also drawing all reasonable inferences in that party's favor. Roell v. Hamilton Cty. , 870 F.3d 471, 479 (6th Cir. 2017) (citing Watson v. Cartee , 817 F.3d 299, 302 (6th Cir. 2016) ); Matsushita Elec. Indus. Co. v. Zenith Radio Corp. , 475 U.S. 574, 587, 106 S.Ct. 1348, 89 L.Ed.2d 538 (1986). The Court "may not make credibility determinations *777nor weigh the evidence." Laster v. City of Kalamazoo , 746 F.3d 714, 726 (6th Cir. 2014). "The burden is generally on the moving party to show that no genuine issue of material fact exists, but that burden may be discharged by 'showing ... that there is an absence of evidence to support the nonmoving party's case.' " Bennett v. City of Eastpointe , 410 F.3d 810, 817 (6th Cir. 2005) (quoting Celotex Corp. v. Catrett , 477 U.S. 317, 324, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986) ). When the motion is supported by documentary proof such as depositions and affidavits, the nonmoving party may not rest on his pleadings but instead must present some "specific facts showing that there is a genuine issue for trial." Celotex Corp. , 477 U.S. at 324, 106 S.Ct. 2548 ; Eastham v. Chesapeake Appalachia, L.L.C. , 754 F.3d 356, 360 (6th Cir. 2014). These facts must be more than a scintilla of evidence and must meet the standard of whether a reasonable juror could find by a preponderance of the evidence that the nonmoving party is entitled to a verdict in his favor. Anderson v. Liberty Lobby, Inc. , 477 U.S. 242, 252, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). The Court must, however, enter summary judgment "against a party who fails to ... [meet the burden] that party will bear ... at trial." Celotex Corp , 477 U.S. at 322, 106 S.Ct. 2548.

ANALYSIS

The instant cross-Motions for Summary Judgment are unusual in the sense that the parties are in apparent agreement that the record contains no material factual disputes. Pls.' Mem. in Supp. of Mot. for Partial Summ. J., at 6, Apr. 26, 2018, ECF No. 95-1; Def.'s Mem. of Facts & Law in Supp. of Its Mot. for Continuance of Trial, at 1, July 16, 2018, ECF No. 124-2. The parties simply "disagree about the legal significance of those facts." Pls.' Mem. in Supp. of Mot. for Partial Summ. J., at 6, ECF No. 95-1; Def.'s Mem. of Facts & Law in Supp. of Its Mot. for Continuance of Trial, at 1, ECF No. 124-2. After reviewing the parties' various statements of facts and the responses thereto, the Court agrees. In this case, summary judgment is a particularly appropriate method of evaluating Plaintiffs' claims and determining whether the undisputed record supports each of Plaintiffs' claims, thus entitling Plaintiffs to judgment as a matter of law on the issue of Defendant's liability, or whether Plaintiffs have failed to establish such claims, thereby entitling Defendant to the dismissal of those claims. The Court considers each claim below in the context of the arguments made by parties in their respective supporting memoranda, responses, and replies. Ultimately, however, the Court concludes that Plaintiffs have failed to establish any of their claims in the undisputed record. And therefore it is Defendant who is entitled to judgment as a matter of law and the dismissal of each of Plaintiffs' claims.

I. Negligence and Negligence Per Se Claims

The Court previously articulated the required elements of negligence and negligence per se claims when it disposed of Defendant's Motion to Dismiss. Therein, the Court noted that a negligence claim requires (1) a duty owed by a defendant to the plaintiff; (2) a breach of that duty by the defendant; (3) a harm suffered by the plaintiff; and (4) causation of the plaintiff's harm by the defendant's breach. See Faber v. Ciox Health, LLC , 2017 WL 5957206, at *5, 2017 U.S. Dist. LEXIS 218524, at *18-19 (W.D. Tenn. Sept. 29, 2017) (quoting West v. East Tenn. Pioneer Oil Co. , 172 S.W.3d 545, 550 (Tenn. 2005) ). The fourth element, causation, is divided into two sub-elements: proximate cause and cause in fact. See id. Negligence per se claims, on *778the other hand, allow Plaintiffs to substitute a statutory duty for the normal duty of care and a violation of that statute for the element of breach. See id. (quoting Nevill v. Tullahoma , 756 S.W.2d 226, 232 (Tenn. 1988) ; Brookins v. Round Table, Inc. , 624 S.W.2d 547, 550 (Tenn. 1981); Smith v. Owen , 841 S.W.2d 828, 831 (Tenn. Ct. App. 1992) ; Traylor v. Coburn , 597 S.W.2d 319, 322 (Tenn. Ct. App. 1980) ). The statute, however, must have been enacted for the purpose of protecting a specific class of people. See id. And Plaintiffs must be among that class. Id.

But first the Court must determine whether overcharging for medical records in violation of HIPAA and HITECH may even support negligence per se or negligence claims under Tennessee law. In denying Defendant's Motion to Dismiss on this issue, the Court erred on the side of caution in order to permit the parties to further brief this question of law rather than prematurely dismiss Plaintiffs' claims. But the Court expressly limited its conclusion to that Motion. Now the Court intends to resolve the issue.

Defendant asserts once again that there is no remedy under Tennessee law for a violation of HIPAA or HITECH. Defendant notes first that the parties are in agreement that neither HIPAA nor HITECH provides a private cause of action and second that Tennessee does not recognize an independent cause of action for overcharging. Plaintiffs, however, argue that Tennessee has regularly recognized violations of federal law, even of those statutes or regulations that do not provide a private cause of action, as providing the basis for a negligence per se claim or informing the standard of care for an ordinary negligence claim. Cases offered to this Court by Plaintiffs indeed demonstrate that the Tennessee Supreme Court has not limited the doctrine of negligence per se to violations of state law. Compare Bellamy v. Federal Express Corp. , 749 S.W.2d 31, 35 (Tenn. 1988) (stating that "proof of violation of the state or federal statutes will constitute negligence per se " ), with St. Luke Hosp., Inc. v. Straub , 354 S.W.3d 529, 534 (Ky. 2011) ("Violations of federal laws and regulations and the laws of other states do not create a cause of action based on [Kentucky's negligence per se statute]."). But the application of federal law to negligence per se claims under Tennessee law has not been wholesale. For example, in Bellamy , the Tennessee Supreme Court did not endorse the idea of every federal statute or regulation providing the basis for a negligence per se claim; it refers to "proof of violation of the state or federal statutes," meaning the regulations issued under the Federal Occupational Safety and Health Act and the Tennessee Occupational Safety and Health Act of 1972. 749 S.W.2d at 32, 35 (emphasis added). And in Estate of French v. Stratford House , 333 S.W.3d 546, 561-63 (Tenn. 2011), another case relied on by Plaintiff, the Tennessee Supreme Court permitted proof of violations of federal regulations to be admitted as relevant evidence that informed ordinary negligence claims but declined to allow such proof to establish negligence per se because of a conflict with state medical malpractice law. Thus, it is clear to the Court that the question presented must be specifically answered as to HIPAA.¹² Indeed, "under Tennessee law, the determination of whether negligence per se claims are actionable under a certain statute has been found to be 'analytically related' to whether an implied private right of action exists under a legislative enactment."

*779In re Tenn. Valley Auth. Ash Spill Litig. , 2012 WL 3647704, at *60, 2012 U.S. Dist. LEXIS 122231, at *207 (E.D. Tenn. Aug. 23, 2012) (citing Rains v. Bend of the River , 124 S.W.3d 580, 588-89, n.5 (Tenn. Ct. App. 2003) ; Thomas & Assocs., Inc., v. Metro. Gov't of Nashville & Davidson Cty. , 2003 WL 21302974, at *10, 2003 Tenn. App. LEXIS 425, at *28-30 (Tenn. Ct. App. June 6, 2003) ) (emphasis added); cf. Premium Fin. Corp. of Am. v. Crump Ins. Servs. , 978 S.W.2d 91, 94 (Tenn. 1998) ("Where an act as a whole provides for governmental enforcement of its provisions, we will not casually engraft means of enforcement of one of those provisions unless such legislative intent is manifestly clear.").

After due consideration of the parties' respective positions, the Court is not convinced that Tennessee law permits a private action based upon a violation of the immense federal regulatory framework that is HIPAA. Plaintiffs unconvincingly base their argument on past allowances of different federal statutes and regulations to support a claim for negligence per se. Interestingly though, Plaintiffs provide two instances where federal courts sitting in Tennessee, including another member of this Court, have been open to negligence per se claims proceeding though no private right of action existed under the statute in question. In the first of these decisions, however, Judge J. Daniel Breen of this Court did not allow the claim to ultimately proceed because the statute merely involved "the State's general supervision of disposal sites." United Inventory Servs. v. Tupperware Brands Corp. , 2010 WL 1009978, at *5, 2010 U.S. Dist. LEXIS 23965, at *13 (W.D. Tenn. Mar. 15, 2010). And in the second case, the United States District Court for the Middle District of Tennessee only noted that negligence per se claims did not necessarily require a private right of action and sustained the particular claim because the defendant had not articulated a sufficient basis for summary judgment. Wildasin v. Mathes , 176 F.Supp.3d 737, 751 (M.D. Tenn. 2016). Neither of these cases conflict with the Court's understanding of Tennessee law in these matters. The problem for Plaintiffs is that they simply do not offer any applicable legislative mandate tending to show that a private right of action exists to enforce HIPAA. Likely because no such mandate exists. As Plaintiffs have already conceded, there is no independent cause of action under HIPAA. Thomas v. Univ. of Tenn. Health Sci. Ctr. , 2017 WL 9672523, at *2, 2017 U.S. App. LEXIS 24714 at *4 (6th Cir. Dec. 6, 2017) ("[A]lthough we have not held explicitly that there is no private right of action under HIPAA, express or implied, other circuits have so held. Instead, HIPAA provides for penalties to be imposed by the Secretary of the Department of Health and Human Services ("DHHS") .... [and,] the proper avenue for redress is to file a complaint with the DHHS."); see also Hatfield v. Berube , 714 F. App'x 99, 105-06 (3d Cir. 2017) (quoting Wilkerson v. Shinseki , 606 F.3d 1256, 1267 n.4 (10th Cir. 2010) ) ("HIPAA does not create a private right of action for alleged disclosures of confidential medical information...."); Webb v. Smart Document Sols., LLC , 499 F.3d 1078, 1081 (9th Cir. 2007) ("HIPAA itself provides no private right of action."); Acara v. Banks , 470 F.3d 569, 571 (5th Cir. 2006) ("Congress did not intend for private enforcement of HIPAA."). The Court will not of its own accord "casually engraft means of enforcement" of HIPAA into Tennessee law. Premium Fin. Corp. of Am. , 978 S.W.2d 91, 94. Accordingly, the Court must conclude that HIPAA does not establish an independent duty under Tennessee law or otherwise establish a private means of enforcement. And because HIPAA is not applicable here, the Court need *780not decide whether Defendant violated any of its provisions.

Plaintiffs have asserted neither an alternative statute nor an alternative basis for a duty owed by Defendant under Tennessee law. As a result, Plaintiffs' negligence and negligence per se claims must fail as a matter of law. Defendant's Motion for Summary is accordingly GRANTED , and Plaintiffs' Motion for Partial Summary Judgment is likewise DENIED . Plaintiffs' claims of negligence and negligence per se are accordingly DISMISSED .

II. Breach of Fiduciary Duty or Confidential Relationship Claims

In Count IV of their Amended Complaint, Plaintiffs raise claims of breach of fiduciary duty or confidential relationship. They alleged that Defendant owed patients, including the named Plaintiffs and the class plaintiffs, a fiduciary duty in the supervision, handling, control, and production of the patients' medical records. Plaintiffs assert that Defendant breached its duty to them by failing to properly provide the requested medical records, and that, because of Defendant's failure, Plaintiffs suffered injuries-specifically, the direct costs of excessive fees and the indirect harm of delay in acquiring their medical records in order to pursue other litigation. Defendant, however, argues that the undisputed facts of this case demonstrate that no fiduciary relationship arose between the parties, and therefore Plaintiffs cannot establish their claims for breach of fiduciary duty or confidential relationship.

The distinction under Tennessee law between breach of fiduciary duty and breach of a confidential relationship stems from Tennessee's recognition of two primary categories of fiduciary relationships. See Grant v. Tucker , 57 F.Supp.3d 852, 859 (M.D. Tenn. 2014). "The first is fiduciary per se , 'such as between a guardian and ward, an attorney and client, or conservator and incompetent.' " Id. at 859 (quoting Foster Bus. Park, LLC v. Winfree , 2009 WL 113242, at *12 (Tenn. Ct. App. Jan. 15, 2009) ). To put the effect of such a relationship artlessly, a fiduciary owes a fiduciary duty-"to act for the benefit of another person on all matters within the scope of their relationship." Fiduciary, Black's Law Dictionary (10th ed. 2014). And a breach of that duty gives rise to a claim that can be established by demonstrating: "(1) a fiduciary relationship, (2) breach of the resulting fiduciary duty, and (3) injury to the plaintiff or benefit to the defendant as a result of that breach." In re Estate of Potter , 2017 WL 4546788, at *2 (Tenn. Ct. App. Oct. 11, 2017) (quoting Ann Taylor Realtors, Inc. v. Sporup , 2010 WL 4939967, at *3 (Tenn. Ct. App. Dec. 3, 2010) ); see also 37 C.J.S. Fraud § 15 (2008) (cited by the Sporup court).

The second type of fiduciary relationship is the confidential relationship. Unlike the fiduciary per se , the confidential relationship is not based in the sorts of relationships that have long been established under the law. Identifying a confidential relationship involves an examination of "the particular facts and circumstances of the case to determine whether one party exercised dominion and control over another, weaker party." Grant , 57 F.Supp.3d at 859 (quoting Foster Bus. Park, LLC , 2009 WL 113242, at *12 ). The Court must evaluate whether

(1) the defendant was in a position to influence or control the plaintiff; (2) the defendant used the confidences given to him or her to obtain some benefit from, or advantage over, the plaintiff; and (3) the plaintiff, as the dominated party in the relationship, suffered some detriment at the hands of the defendant.

*781Givens v. Mullikin , 75 S.W.3d 383, 410 (Tenn. 2002) (citing Mahunda v. Thomas , 55 Tenn.App. 470, 402 S.W.2d 485, 489 (1965) ). These elements, however, are not mutually exclusive. Establishing a confidential relationship only amounts to establishing the existence of a fiduciary duty. See Grant , 57 F.Supp.3d at 859-60 (citing Union Planters Bank of Middle Tenn. v. Choate , 2000 WL 1231383, at *3 (Tenn. Ct. App. Aug. 31, 2000) ; Restatement (Second) of Torts § 874 (1979) ) (noting that harm and causation remain essential elements). Thus, no matter how Plaintiffs establish the existence of a fiduciary duty, they still bear the burden of demonstrating the second and third element of the breach of fiduciary duty claim. Here, however, the Court is limited to an analysis of the confidential relationship because Plaintiffs fail to establish its existence. And because there is no confidential relationship, there is no fiduciary duty. Therefore, Plaintiffs' claims must fail.

The Court is not persuaded that a confidential relationship existed between Defendant and Plaintiffs. The undisputed record shows that Plaintiffs and Defendant were not akin to the partners-to-be in horse breeding (and marriage) involved in Grant, 57 F.Supp.3d at 860. And the other cases cited by Plaintiffs involve no finding of a confidential relationship. But the general rule is that "parties dealing at arm's length 'lack the sort of relationship of trust and confidence that gives rise to a fiduciary relationship.' " Hall v. Liberty Ins. Corp. , 2013 WL 6571928, at *6 (E.D. Tenn. Dec. 13, 2013) (quoting Dick Broadcasting Co., Inc. v. Oak Ridge FM, Inc. , 395 S.W.3d 653, 673 (Tenn. 2013) (Koch, J., concurring) ). There can be little doubt that the law firms representing Plaintiffs in this matter and Defendant, perhaps the largest provider of medical records in the country, are the sort of sophisticated parties well versed in the "impersonal laws of the marketplace." Dick Broadcasting Co., Inc. , 395 S.W.3d at 674 (Koch, J., concurring). The distance between the parties is only increased when one considers that Plaintiffs initially sought their records from the distinct hospital entities that contracted with Defendant to perform records management services for them. Though the law firms were merely representing Plaintiffs in these interactions, they were no doubt sought-and the undisputed record reflects as much-by Plaintiffs precisely because of their sophistication or else Plaintiffs might have simply handled the matter themselves. The Court fails to see how Defendant might have influenced or controlled Plaintiffs when, despite Defendant's possession of Plaintiffs' medical records, every interaction that was ostensibly between Defendant and Plaintiffs was at the very least filtered through the classic fiduciary relationship of client and attorney. Furthermore, it is not clear to the Court that overcharging is the sort of abuse of a confidential position that Tennessee law envisions as leading to the cause of action Plaintiffs bring here. Plaintiffs certainly cite no authority for this proposition.

The Court finds that Plaintiffs have not established the existence of a confidential relationship. Without such a relationship, Plaintiffs cannot sustain their claims for breach of fiduciary duty or confidential relationship. Therefore, on the issue of such claims, Defendant's Motion for Summary Judgment is GRANTED , and Plaintiffs' Motion for Partial Summary Judgment is DENIED . Plaintiffs' claims for breach of fiduciary duty or confidential relationship are hereby DISMISSED .

III. Breach of Implied Contract Claims

The next series of claims that the parties seek summary judgment on are Plaintiffs' claims for breach of an implied contract. Tennessee law recognizes two types of implied *782contracts: those implied in fact and those implied in law. See Freeman Indus. LLC v. Eastman Chem. Co. , 172 S.W.3d 512, 524 (Tenn. 2005) (citing Paschall's, Inc. v. Dozier , 219 Tenn. 45, 407 S.W.2d 150, 153-54 (1966) ). "Contracts implied in fact arise under circumstances establishing the parties' mutual intention to contract." Id. (citing Paschall's, Inc. , 407 S.W.2d at 154 ). Such contracts "must embody all the elements of an express contract, including an actual agreement between the parties." Conner v. Hardee's Food Sys. , 65 F. App'x 19, 24 (6th Cir. 2003) (quoting Contship Containerlines, Inc. v. Howard Indus. , 309 F.3d 910, 913 (6th Cir. 2002) ). Indeed, the only material difference between a typical contract and a contract implied in fact is the lack of a memorialization of the contract. See id. (quoting River Park Hosp., Inc. v. BlueCross BlueShield of Tenn., Inc. , 173 S.W.3d 43, 57 (Tenn. Ct. App. 2002) ); cf. Oliver Wendell Holmes, Jr., The Common Law 260-264 (Dover Publ'ns, Inc. 1991) (1881) (discussing the common law's "preference" for proof of a contract by writing). "To be enforceable under Tennessee law, a contract 'must result from a meeting of the minds of the parties in mutual assent to the terms, must be based upon a sufficient consideration, free from fraud or undue influence, not against public policy[,] and sufficiently definite to be enforced.' " Starnes Family Office, LLC v. McCullar , 765 F.Supp.2d 1036, 1050 (W.D. Tenn. 2011) (quoting Doe v. HCA Health Servs. of Tenn. , 46 S.W.3d 191, 196 (Tenn. 2001) ). On the other hand, "[c]ontracts implied in law ... are created by law without the parties' assent and are based upon reason and justice." Freeman Indus. LLC , 172 S.W.3d at 524 (citing Paschall's, Inc. , 407 S.W.2d at 154 ; Angus v. City of Jackson , 968 S.W.2d 804, 808 (Tenn. Ct. App. 1997) ). "Courts may impose a contract implied in law where no contract exists under various quasi contractual theories, including unjust enrichment." Id. (citing Whitehaven Cmty. Baptist Church v. Holloway , 973 S.W.2d 592, 596 (Tenn. 1998) ). For the purposes of the breach of implied contract claims, the Court will limit its analysis to the claims of a contract implied in fact because Plaintiffs separately raise unjust enrichment claims.

Defendant asserts that Plaintiffs' implied contract claims must fail because Plaintiffs have not identified any of the terms of the implied contract that Defendant supposedly breached. Defendant further argues that the undisputed record shows that the parties never formed or even intended to form any sort of binding agreement. Plaintiffs, however, maintain that Defendant held itself out to the public as a provider of medical records on behalf of its clients, and in doing so, offered to provide medical records in a HIPAA-compliant manner upon request. This implied contract required, according to Plaintiffs, Defendant to provide patients' medical records at a reasonable and lawful cost to patients without unreasonable delay.

Defendant quite clearly expected payment for the provision of medical records, though they maintain they sought payment from the requesting law firms if not the precise paralegals who made the requests. And Plaintiffs' argument inherently recognizes that the parties receiving those records expected to pay something for the services rendered¹³ *783by Defendant, evidently a "reasonable" price. The Court need not decide, however, whether Defendant entered into contracts with Plaintiffs or with their law firms. Plaintiffs' claims boil down to a breach premised upon an unreasonable price and unreasonable delay in performance. It is worth recalling, however, that "under Tennessee law, a contract ... 'must be ... sufficiently definite to be enforced.' " Starnes Family Office, LLC , 765 F.Supp.2d at 1050 (quoting HCA Health Servs. of Tenn. , 46 S.W.3d at 196 ). "Indefiniteness regarding an essential element of a contract 'may prevent the creation of an enforceable contract.' " HCA Health Servs. of Tenn. , 46 S.W.3d at 196 (quoting Jamestowne On Signal, Inc. v. First Fed. Sav. & Loan Ass'n , 807 S.W.2d 559, 565 (Tenn. Ct. App. 1990) ). This is because "[a] contract 'must be of sufficient explicitness so that a court can perceive what are the respective obligations of the parties.' " Id. (quoting Higgins v. Oil, Chemical & Atomic Workers Int'l Union, Local # 3-677 , 811 S.W.2d 875, 880 (Tenn. 1991) ). While an offeror and offeree may properly "agree upon payment of a 'reasonable' price," see HCA Health Servs. of Tenn. , 46 S.W.3d at 196, the undisputed facts do not reveal such an agreement. Defendant holds itself out as being in compliance with HIPAA, something that any individual or entity that is involved with medical records must do. And from Defendant doing so, Plaintiffs are attempting to create contractual terms from the provisions of HIPAA itself. But some evidence is needed to show that, in advertising itself as compliant with HIPAA, Defendant was not engaging in mere puffery or salesmanship but actually sought to incorporate HIPAA as part of a contract between itself and Plaintiffs. No such evidence was provided here. There is no indication of a price term or timeliness-of-the-performance term that the Court is able to adequately perceive and enforce. Thus, Plaintiff has not established any contract term implied in fact that is sufficiently definite for the Court to determine whether Defendant breached it. Furthermore, as Defendant points out in its Response to Plaintiffs' Motion, Plaintiff has not made any argument seeking to establish the essential elements of a contract in the undisputed facts.

Accordingly, as to the claim of a breach of an implied contract in fact, Defendant's Motion for Summary Judgment is GRANTED , and Plaintiffs' Motion for Partial Summary Judgment is DENIED . Plaintiffs' claims for breach of implied contract in fact are DISMISSED .

IV. Breach of the Covenant of Good Faith and Fair Dealing Claims

Defendant correctly states the law that parties to a contract "owe each other a duty of good faith and fair dealing as it pertains to the performance of a contract." Berry v. Mortgage Elec. Registration Sys. , 2013 WL 5634472, at *7, 2013 Tenn. App. LEXIS 682, at *21 (Tenn. Ct. App. Oct. 15, 2013) (quoting Ike v. Quantum Servicing Corp. , 2012 WL 3727132, at *5, 2012 U.S. Dist. LEXIS 121422, at *12 (W.D. Tenn. Aug. 27, 2012) ). The Court has already concluded that Plaintiffs have failed to even establish a contract. Therefore, as to Plaintiffs' claims of breach of the duty of good faith and fair dealing, Defendant's Motion for Summary Judgment is GRANTED , and Plaintiffs' Motion for Partial Summary Judgment is DENIED . Accordingly, Plaintiffs' claims of breach of the duty of good faith and fair dealing are hereby DISMISSED .

*784V. Unjust Enrichment Claims

Plaintiffs are correct that, in Tennessee, the "[c]ourts will impose a contractual obligation under an unjust enrichment theory when: (1) there is no contract between the parties or a contract has become unenforceable or invalid; and (2) the defendant will be unjustly enriched absent a quasi-contractual obligation." Whitehaven Cmty. Baptist Church , 973 S.W.2d at 596 (citing Paschall's Inc. , 407 S.W.2d at 154-55 ). Because Plaintiffs have failed to establish such a contract, the Court will assume that it does not exist. Thus, the issue is whether Defendant will be unjustly enriched if the Court does not impose a "quasi-contractual obligation" upon it. Defendant argues that it will not be unjustly enriched because Plaintiffs have articulated no basis for the Court to find that an injustice has occurred beyond the inapplicable statutes referenced by Plaintiffs. Defendant makes two additional arguments against imposing such an obligation: first, that Plaintiffs' claims are barred by the voluntary payment doctrine; and second, that Plaintiffs may not recover for an unjust enrichment theory because Plaintiffs have not exhausted all of their remedies. Plaintiffs, on the other hand, maintain that Defendant unjustly retains the benefits of overcharging for Plaintiffs' access to their medical records. Plaintiffs also argue against the application of the exhaustion theory, asserting that exhaustion of remedies is not required when exhaustion would be futile, or the voluntary payment doctrine, maintaining that it is inapplicable in this instance because the transactions at issue here were violative of public policy. The Court does not reach the parties' arguments regarding the voluntary payment doctrine or exhaustion. Instead, it finds that Plaintiffs have not demonstrated that Defendant's retention of certain fees would be unjust.

A defendant is unjustly enriched if (1) the plaintiff conferred a benefit upon the defendant; (2) the defendant is aware of the benefit, and (3) retention of the benefit by the defendant would be unjust. Freeman Indus. LLC , 172 S.W.3d at 525 (quoting Paschall's, Inc. , 407 S.W.2d at 155 ). While there is no dispute that Defendant knowingly received a benefit, the parties do dispute whether Plaintiffs or their law firms actually conferred that benefit. It appears, however, that this dispute is inconsequential. Plaintiffs point to the Tennessee Supreme Court's holding that a plaintiff need not directly confer the benefit upon the defendant. Id. In support of its holding, the Tennessee Supreme Court specifically notes a decision that concluded that "benefits can be direct or indirect, and can involve benefits conferred by third parties." Id. (quoting State ex rel. Palmer v. Unisys Corp. , 637 N.W.2d 142, 155 (Iowa 2001) ). Thus, the issue here is whether Defendant's retention of its fees above the costs needed to provide the medical records is unjust. Plaintiffs assert that it is because neither federal nor Tennessee law authorized Defendant to collect basic fees, electronic delivery fees, or per-page paper fees when those fees exceeded the actual labor and supply costs of providing the records. But the Court is not persuaded. The idea that an individual or entity must be "authorized" by the State to charge for a service is antithetical to our form of government.¹⁴ But if Tennessee *785and the federal government prohibit the collection of fees for the provision of medical records with certain exceptions, which is perhaps what Plaintiffs intended to assert, then the fees charged by Defendant may be precluded if said fees do not fall within the exceptions. The problem with this argument, however, is that the Court has previously concluded that the Tennessee statute cited to by Plaintiffs is inapplicable to Defendant, Tenn. Code Ann. 68-11-304(a) ; Faber , 2017 WL 5957206, at *4, 2017 U.S. Dist. LEXIS 218524, at *13-16, and that the cited federal statutes do not create a private right of action under Tennessee law. Thus, Plaintiffs ultimately give the Court no basis to find that these fees are unjust.

Therefore, on the issue of Plaintiffs' claims for unjust enrichment and breach of contract implied in law , Defendant's Motion for Summary Judgment is GRANTED , and Plaintiffs' Motion for Partial Summary Judgment is DENIED . Accordingly, Plaintiffs' claims for unjust enrichment and breach of contract implied in law are hereby DISMISSED .

VI. Injunctive Relief

The parties are in agreement that there are no freestanding claims for injunctive relief in this case. Instead, Plaintiffs have merely asserted that injunctive relief would be proper if they succeed on any of their claims. Accordingly, to the extent that Plaintiffs brought freestanding claims for injunctive relief, such claims are hereby DISMISSED .

VII. Tennessee Consumer Protection Act Claims

Finally, the Court reaches Plaintiffs' claims under the Tennessee Consumer Protection Act of 1977 (the "TCPA"), Tenn. Code Ann. § 47-18-101 et seq. As clarified in the Court's Order on Defendant's Motion to Dismiss, these claims are brought by Plaintiffs individually and not on behalf of the class plaintiffs. See Faber , 2017 WL 5957206, at *7, 2017 U.S. Dist. LEXIS 218524, at *23-24 (citing Walker v. Sunrise Pontiac-GMC Truck, Inc. , 249 S.W.3d 301, 310 (Tenn. 2008) ). The TCPA generally prohibits "[u]nfair or deceptive acts or practices affecting the conduct of any trade or commerce...." Tenn. Code Ann. § 47-18-104(b). In its Amended Complaint, Plaintiffs alleged that "Defendant made deceptive representations, material non-disclosures, and misrepresentations of its conduct as lawful" all in violation of the TCPA. But specifically, Plaintiffs only pointed to subsection 47-18-104(b)(15), alleging that "Defendant failed to disclose to Plaintiffs that a charge for Plaintiffs' medical records was, in whole or in part, based on a predetermined rate or charge instead of the value of the services actually performed."

As a preliminary matter, Defendant correctly points out that Plaintiffs cannot effectively amend their Complaint by raising claims for the first time at summary judgment lest Defendant be subjected to unfair surprise. See Tucker v. Union of Needletrades, Indus., & Textile Employees. , 407 F.3d 784, 788 (6th Cir. 2005). In this instance, Plaintiffs specifically reference subsections 47-18-104(b)(5), (7), and (9) for the first time in their Motion for Partial Summary Judgment. And Plaintiffs do not respond to this argument in their Reply. Thus, the Court agrees with Defendant and will only consider Plaintiffs' argument as to subsection 47-18-104(b)(15).¹⁵

Plaintiffs assert that Defendant violated the TCPA by failing to disclose that it charged a predetermined per-page *786rate rather than the cost-based fees it incurred in processing the requests. But as Plaintiffs make clear by referencing the federal statutes in the same paragraph of their Response, this is a HIPAA-based argument of no relevance to the TCPA. Plaintiffs raise no argument that Defendant did not charge "the values of the services actually performed" as they alleged in their Amended Complaint. Therefore, as to Plaintiffs' TCPA claims, Defendant's Motion for Summary Judgment is GRANTED , and Plaintiffs' Motion for Partial Summary Judgment is DENIED . Accordingly, Plaintiffs' TCPA claims are hereby DISMISSED .

CONCLUSION

For the foregoing reasons, Defendant's Motion is GRANTED , and Plaintiffs' Motion is DENIED . Accordingly, Plaintiffs' Amended Complaint is hereby DISMISSED , and the Clerk is DIRECTED to enter Judgment in favor of Defendant.

The Court notes with some concern that this result is a harsh one considering that Defendant had sole control of Plaintiffs' medical records and by all accounts charged fees that, in other situations, would be considered excessive and potentially unlawful. Any direct remedy, however, lies within the purview not of the Court but the Tennessee General Assembly or the United States Congress. Here, Congress has seen fit to limit enforcement of HIPAA to the Government. And the General Assembly has likewise seen fit to limit the application of Tennessee's own medical records statute to hospitals. The Court cannot ignore those legislative decisions.

IT IS SO ORDERED.

1 Defendant points out, without expressly disputing the fact, that Plaintiffs did not provide support for its statement that Defendant is the largest medical records provider in the country. Def.'s Resp. to Pls.' Statement of Undisputed Facts, ¶ 6, May 31, 2018, ECF No. 108.

2 Defendant disputes this phrasing because "the only cost-based rate is a special rate under HIPAA that can apply only when patients or their personal representatives themselves make record requests." Def.'s Resp. to Pls.' Statement of Undisputed Facts, ¶ 7, ECF No. 108.

3 Plaintiffs contend that Defendant sent the invoice to Ballin, Ballin & Fishman, P.C. Pls.' Resp. to Def.'s Statement of Undisputed Facts, ¶ 7, May 31, 2018, ECF No. 106-2. But the invoice, though listing Ballin, Ballin & Fishman, P.C., as the requester, clearly states that Ms. Asbridge is the recipient of the bill. HealthPort Invoice No. 0163671769, Feb. 28, 2015, ECF No. 90-2.

4 See supra note 3; HealthPort Invoice No. 0182201188, Dec. 8, 2015, ECF No. 90-4.

5 Plaintiffs dispute this statement, claiming that Plaintiff Faber was unsure whether the invoices were sent to his home. Pls.' Resp. to Def.'s Statement of Undisputed Facts, ¶ 12, ECF No. 106-2. But Plaintiffs cite to a portion of Plaintiff Faber's deposition not presently in the record because it was not among the exhibits filed contemporaneously with the parties' various memoranda for the instant Motions.

6 Plaintiffs claim that the first letter regarding Plaintiff Monroe was sent on January 20, 2016. Pls.' Statement of Undisputed Material Facts, ¶ 33, Apr. 26, 2018, ECF No. 95-2 (citing Ex. 4(a), at 5, Mar. 30, 2018, ECF No. 70-8). There are some inconsistencies in the record here as the specific page cited by Plaintiffs states that the request was mailed on January 20, 2016, but the letter attached to the various forms is dated January 29, 2016. See Ex. 4(a), at 1, 5, ECF No. 70-8. In disputing Plaintiffs' statement on the basis that Ms. Harris sent the request, Defendant cites to its exhibit of the same group of documents. See Ex. 4(a), Apr. 26, 2018, ECF No. 90-8. There are additional factual disputes as to a letter that may have been sent on January 13, 2016. See Def.'s Resp. to Pls.' Statement of Add'l Material Facts, ¶¶ 12-14, June 15, 2018, ECF No. 113.

7 Plaintiffs contend that Defendant sent this invoice to Wolff Ardis, P.C. Pls.' Resp. to Def.'s Statement of Undisputed Facts, ¶ 17, ECF No. 106-2. But the invoice, though listing Wolff Ardis, P.C., as the requester, clearly states that Ms. Harris is the recipient of the bill. HealthPort Invoice No. 0186100957, Feb. 11, 2016, ECF No. 90-7.

8 See supra note 7; HealthPort Invoice No. 0187519649, Mar. 2, 2016, ECF No. 90-9.

9 See supra notes 7-8.

10 Unlike the previous invoices, see supra notes 3-4, 7-9, this invoice lists Wolff Ardis, P.C., as the party being billed. HealthPort Invoice No. 0198600613, Aug. 16, 2016, ECF No. 90-10.

11 Defendant disputes this statement because Plaintiff Monroe received the hard copies that were sent to her attorneys. While true, the undisputed facts show that Defendant also billed Plaintiff Monroe, her attorneys, or their paralegal for paper copies in instances where no hard copies were sent.

12 The Court will henceforth include HITECH in its use of "HIPAA."

13 The parties do not appear to address this issue, but the Court assumes that, because Defendant maintains and copies pre-existing medical records in order to provide them to patients, Defendant performs a service and does not sell goods. Therefore, the Court does not apply the provisions of Article 2 of the Uniform Commercial Code, as adopted by Tennessee, to this alleged contract.

14 This notion ignores the very concept of natural rights. See John Locke, Two Treatises of Government 288 (Peter Laslett ed., Cambridge Univ. Press 2009) (1690); cf. The Declaration of Independence , paras. 1-2 (U.S. 1776). While medical records created by a hospital in treating a patient to assist the future care of that patient are a far cry from Locke's "Apples he gathered from the Trees in the Wood," Locke, supra , at 288, the simple fact remains that Defendant does not require the government's permission to act.

15 Furthermore, Plaintiffs' arguments under subsections 47-18-104(b)(5), (7), and (9) suffer from the same defect as their argument under subsection 47-18-104(b)(15).